fix: handle x-forwarded-host and proxy issues behind Cloudflare (#370)

apps/web/src/pages/api/auth/[...all].ts

@@ -13,6 +13,23 @@ const authHandler = toNodeHandler(auth.handler);
 export default withRateLimit(
   { points: 100, duration: 60 },
   async (req, res) => {
+    /**
+     * Better-auth behind proxies (Nginx/Cloudflare) can sometimes fail to parse the protocol
+     * if headers are incorrectly set or if there are multiple values in X-Forwarded-Proto.
+     * We sanitize these headers here to ensure better-auth gets a clean protocol and host.
+     */
+    const forwardedProto = req.headers["x-forwarded-proto"];
+    if (forwardedProto) {
+      const p = Array.isArray(forwardedProto) ? forwardedProto[0] : forwardedProto;
+      req.headers["x-forwarded-proto"] = p?.split(",")[0]?.trim();
+    }
+
+    const forwardedHost = req.headers["x-forwarded-host"];
+    if (forwardedHost) {
+      const h = Array.isArray(forwardedHost) ? forwardedHost[0] : forwardedHost;
+      req.headers["host"] = h?.split(",")[0]?.trim();
+    }
+
     return await authHandler(req, res);
   },
 );

packages/auth/src/auth.ts

@@ -11,15 +11,16 @@ import { createPlugins } from "./plugins";
 import { configuredProviders } from "./providers";
 
 export const initAuth = (db: dbClient) => {
+  const baseURL = env("NEXT_PUBLIC_BASE_URL") || env("BETTER_AUTH_URL");
+  const trustedOrigins = env("BETTER_AUTH_TRUSTED_ORIGINS")?.split(",") ?? [];
+
   return betterAuth({
     secret: env("BETTER_AUTH_SECRET"),
-    baseURL: env("NEXT_PUBLIC_BASE_URL"),
+    baseURL,
-    trustedOrigins: env("BETTER_AUTH_TRUSTED_ORIGINS")
+    trustedOrigins: [
-      ? [
+      ...(baseURL ? [baseURL] : []),
-          env("NEXT_PUBLIC_BASE_URL") ?? "",
+      ...trustedOrigins,
-          ...(env("BETTER_AUTH_TRUSTED_ORIGINS")?.split(",") ?? []),
+    ],
-        ]
-      : [env("NEXT_PUBLIC_BASE_URL") ?? ""],
     database: drizzleAdapter(db, {
       provider: "pg",
       schema: {